Splunk AppDynamics

Is it possible to have "NOT LIKE" in ADQLs?

Sanjay_Girotra
Engager

Hi,

I understand below query is possible:

SELECT count(*) FROM synth_session_records WHERE failureType = "Test location is currently unavailable" AND measurementSpec.scheduleName REGEXP "Test-job.*"

But is this possible:

SELECT count(*) FROM synth_session_records WHERE failureType = "Test location is currently unavailable" AND measurementSpec.scheduleName REGEXP NOT-LIKE "Test-job.*"

Refer below docs:

https://docs.appdynamics.com/display/PRO45/Analytics+Synthetic+Sessions+Data

https://docs.appdynamics.com/display/PRO45/REGEXP+Operator

Thanks.

Labels (1)
0 Karma

Mika_Sasaki1
Explorer

Thanks for posting the question on the Community.

 

NOT LIKE and REGEXP cannot be used at the same time.

dot(.)+asterisk(*) in REGEXP is equal to asterisk(*) in LIKE phrase, so you can use NOT LIKE “Test-job.*“.

“The asterisk(*) character matches zero or more characters. ” as in the document

https://docs.appdynamics.com/display/PRO45/Comparison+Operators

 

Please refer to the following SQL :

SELECT count() FROM synth_session_records WHERE failureType = “Test location is currently unavailable” AND measurementSpec.scheduleName NOT LIKE “Test-job.*“

 

Let me know if this helped you.

 

Many thanks,

Mika

Sanjay_Girotra
Engager

Thanks for the response Mika.

Although it accepted "NOT LIKE", below query worked:

SELECT count(*) FROM synth_session_records WHERE failureType = "Test location is currently unavailable" AND measurementSpec.scheduleName NOT LIKE "Equity*".

Note the missing Dot in NOT LIKE clause after Equity.

So far so good, the follow up question is how to ignore many patterns, say,

SELECT count(*) FROM synth_session_records WHERE failureType = "Test location is currently unavailable" AND measurementSpec.scheduleName NOT LIKE "Test*|Equity*|Find*"

image.jpeg

image.jpeg

Mika_Sasaki1
Explorer

Hi Sanjay,

Unfortunately, regular expression cannot be used with "NOT LIKE".

Please refer to the following SQL :

SELECT count(*) FROM synth_session_records WHERE failureType = "Test location is currently unavailable" AND (measurementSpec.scheduleName NOT LIKE "Test*" OR measurementSpec.scheduleName NOT LIKE "Equity*" OR measurementSpec.scheduleName NOT LIKE "Find*")


Let me know if this helped you.


Many thanks,

Mika

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...